Reading Material
Security Fundamentals & Layered Defense • Lesson 1 of 7
In Progress

MTA 98-367 Certification Overview & Exam Roadmap


Technology plays a role in virtually every business around the world. Possessing the fundamental knowledge of how technology works and understanding its impact on today’s academic and workplace environment is increasingly important—particularly for students interested in exploring professions involving technology. That’s why Microsoft created the Microsoft Technology Associate (MTA) certification—a new entry-level credential that validates fundamental technology knowledge among students seeking to build a career in technology. 

The Microsoft Technology Associate (MTA) certification is the ideal and preferred path to Microsoft’s world-renowned technology certification programs, such as Microsoft Certified Technology Specialist (MCTS) and Microsoft Certified IT Professional (MCITP). MTA is positioned to become the premier credential for individuals seeking to explore and pursue a career in technology or augment related pursuits such as business or any other field where technology is pervasive.

Unit 1: Understanding Security Layers
Unit 2: Understanding Authentication, Authorization, and Accounting
Unit 3: Understanding Security Policies
Unit 4: Understanding Network Security
Unit 5: Protecting the Server and Client

MTA 98-367: Exam 1

Reading Material
Security Fundamentals & Layered Defense • Lesson 2 of 7
In Progress

Unit 1: Understanding Security Layers (Defense-in-Depth)


Remember Points:

  • Before starting to secure an environment, a fundamental understanding of the standard concepts of security is needed. 
  • CIA (an acronym for Confidentiality, Integrity, and Availability) refers to the core goals of an information security program. 
  • Confidentiality deals with keeping information, networks, and systems secure from unauthorized access. 
  • One of the goals of a successful information security program is to ensure the integrity that the information is protected against any unauthorized or accidental changes. 
  • Availability is defined as a characteristic of a resource being accessible to a user, application, or computer system when required. 
  • Threat and risk management is the process of identifying, assessing, and prioritizing threats and risks.
  • Risk is generally defined as the probability that an event will occur. 
  • After prioritizing risks, there are four generally accepted responses to these risks: Avoidance, Acceptance, Mitigation, and Transfer. 
  • The Principle of Least Privilege is a security discipline that requires that a user, system, or application be given no more privilege than necessary to perform its function or job.
  • An attack surface consists of the set of methods and avenues an attacker can use to enter a system and potentially cause damage. The larger the attack surface of an environment, the greater the risk of a successful attack. 
  • The key to thwarting a social engineering attack is employee awareness. If employees know what to look out for, an attacker will find little success. 
  • Physical security uses a defense-in-depth or a layered security approach that controls who can physically access the resources of an organization. 
  • Physical premises can be divided into three logical areas: the external perimeter, the internal perimeter, and secure areas.
  • Computer security consists of the processes, procedures, policies, and technologies used to protect computer systems. 
  • Mobile devices and mobile storage devices are some of the largest challenges facing many security professionals today, because of their size and portability. 
  • A keylogger is a physical or logical device used to capture keystrokes. 
  • Threat modeling is a procedure for optimizing network security by identifying vulnerabilities, identifying their risks, and defining countermeasures to prevent or mitigate the effects of the threats to the system.

Select the correct answer(s) for each of the following questions. 

1. Which of the following are valid risk responses? (Choose all that apply.) 

  1. Mitigation 
  2. Transfer 
  3. Investment 
  4. Avoidance

(a),(b),(d)

As a risk manager, you'll be responsible for managing the risk to an organization, its employees, customers, reputation, assets, and interests of stakeholders. You'll identify and assess threats to an organization, put plans in place for if things go wrong, and decide how to avoid, reduce or transfer risk.


2. Which of the following are considered removable devices or drives? (Choose all that apply.) 

  1. iPod 
  2. Netbook 
  3. USB flash drive 
  4. Burnable DVD drive

(a),(c),(d)

Removable media is any type of storage device that can be removed from a computer while the system is running. Examples of removable media include CDs, DVDs, and Blu-ray disks, as well as diskettes and USB drives. Removable media makes it easy for a user to move data from one computer to another.


3. Which of the following would be considered appropriate security measures for a building’s external security perimeter? (Choose all that apply.) 

  1. Motion detector
  2. Parking lot lights
  3. Turnstile
  4. Guard patrols 

(b), (d)

4. When traveling on business and headed out to dinner with a client, which of the following should be done to secure a laptop? (Choose the best answer.)

  1.  Lock it in the car trunk.
  2. Store it out of sight in a dresser drawer.
  3. Secure it to a piece of furniture with a laptop security cable.
  4. Check it at the Front Desk. 

(a)


5. Which of the following refers to the process of eliminating risk by choosing to not engage in an action or activity? 

  1. Mitigation 
  2. Residual risk 
  3. Avoidance 
  4. Acceptance 

(c)

risk avoidance — by deciding not to go ahead with activity likely to generate risk; risk transfer — by arranging for another party to bear part or all of the risk, for example, insurers; sharing the risk with another party or parties.


6. Which of the following technologies could be used to help ensure the confidentiality of proprietary manufacturing techniques for the auto parts manufacturing business? (Choose all that apply.) 

  1. Strong encryption
  2. Guard patrols
  3. A laptop safe 
  4. Strong authentication 

(a), (d)

Confidentiality deals with keeping information, networks, and systems secure from unauthorized access.


7. The information security acronym CIA stands for which of the following?

  1. Confidentiality, Identity, Access Control
  2. Confidentiality, Integrity, Access Control
  3. Confidentiality, Integrity, Availability 
  4. Control, Identity, Access Control

(c)

CIA (an acronym for Confidentiality, Integrity, and Availability) refers to the core goals of an information security program.


8. Which of the following statements best describes the concept of core security principles? 

  1. Core security principles refer to the internal security perimeter when setting up a layered physical security environment.
  2. Core security principles refer to the principles of confidentiality, availability, and integrity. 
  3. Core security principles refer to leveraging security best practices. 
  4. Core security principles refer to the four methods of addressing risk. 

(b)

The fundamental principles (tenets) of information security are confidentiality, integrity, and availability. Every element of an information security program (and every security control put in place by an entity) should be designed to achieve one or more of these principles. Together, they are called the CIA Triad.


9. As the Chief Security Officer for a small medical records processing company, you have just finished setting up the physical security for your new office. You have made sure that the parking lot is illuminated, that you have guards at the door as well as doing periodic patrols, and you have badge readers throughout the building at key locations. You also have put biometric access technology on the data center door. And of course, you have cameras in the parking lot, building entrances, and the data center entrances. This type of implementation is known as: (Choose the best answer.) 

  1. Access Control 
  2. Core Security Principles 
  3. Security best practices 
  4. Defense in depth. 

(d)


10. Which of the following refers to the process of disabling unneeded services and ports to make the system more secure? 

  1. Reducing the attack surface area 
  2. Mitigating a Trojan horse 
  3. Security avoidance 
  4. Defense-in-depth 

(a)


11. Which type of network traffic originates from outside the network routers and proceeds toward a destination inside the network? 

  1. Ingress 
  2. Egress 
  3. Traverse 
  4. Encrypted 

(a)

Ingress traffic is network traffic that originates from outside of the network's routers and proceeds toward a destination inside of the network.



12. What is characteristic of a business resource—ensuring access is restricted to only permitted users, applications, or computer systems? (answer choices)

  1. Confidentiality
  2. Availability 
  3. Integrity 
  4. Access Control

(a)

The business world defines confidentiality as the characteristic of a resource that ensures access is restricted only to permitted users, applications, or computer systems.

13. If a user is deploying technologies to restrict access to a resource, they are practicing which security principle? (answer choices)

  1. Confidentiality 
  2. Integrity 
  3. Availability 
  4. Access control

(d)

The fundamental principles (tenets) of information security are confidentiality, integrity, and availability. Every element of an information security program (and every security control put in place by an entity) should be designed to achieve one or more of these principles.


14. An action or occurrence that could result in a breach in the security, outage, or corruption of a system by exploiting known or unknown vulnerabilities is a(n) what? (answer choices)

  1. Threat 
  2. Risk 
  3. Integrity 
  4. Availability

(a)

A security breach is any incident that results in unauthorized access to computer data, applications, networks, or devices. It results in information being accessed without authorization. Typically, it occurs when an intruder is able to bypass security mechanisms.


 

15. A Risk Manager for a medium-sized pharmaceutical company who is asked to perform a formal risk analysis would most likely record the results of the risk assessment in a(n) what? (answer choices)

  1. Risk assessment 
  2. Risk register 
  3. Threat Model 
  4. Risk response

(b)

Cyber risk management is the process of identifying, analyzing, evaluating, and addressing your organization's cyber security threats. The first part of any cyber risk management program is a cyber risk assessment.

   

16. What is a method used to gain access to data, systems, or networks, primarily through misrepresentation? (answer choices)

  1. Integrity 
  2. Brute Force 
  3. Social engineering 
  4. Residual risk

(c)

Social engineering is the term used for a broad range of malicious activities accomplished through human interactions. It uses psychological manipulation to trick users into making security mistakes or giving away sensitive information.

17. The consistency, accuracy, and validity of data or information are called what? (answer choices)

  1. Confidentiality 
  2. Integrity 
  3. Availability 
  4. Access Control

(b)

integrity. The consistency, accuracy, and validity of data or information.

18. A business traveler notices that there is an extra connector between the keyboard and the computer in a business center. She has most likely encountered a(n) what? (answer choices)

  1. Malware 
  2. Trojan Horse 
  3. Keylogger 
  4. Jack the Ripper

(c)

Keyloggers are activity-monitoring software programs that give hackers access to your personal data. The passwords and credit card numbers you type, the webpages you visit – all by logging your keyboard strokes. The software is installed on your computer and records everything you type.


19. Refers to the risk of an event that remains after measures have been taken to reduce the likelihood or minimize the effect of the event. (answer choices) 

  1. Risk Mitigation 
  2. Risk Avoidance 
  3. Risk Transfer 
  4. Residual Risk

(d)

Residual risk is the risk that remains after efforts to identify and eliminate some or all types of risk have been made.

Risk mitigation is a strategy to prepare for and lessen the effects of threats faced by a business.

Risk avoidance is the elimination of hazards, activities, and exposures that can negatively affect an organization and its assets. Whereas risk management aims to control the damages and financial consequences of threatening events, risk avoidance seeks to avoid compromising events entirely.

Risk transfer is a risk management and control strategy that involves the contractual shifting of a pure risk from one party to another. One example is the purchase of an insurance policy, by which a specified risk of loss is passed from the policyholder to the insurer.

20. Implementing security measures must always be balanced with what? (answer choices)

  1. Confidentiality 
  2. Integrity 
  3. Cost 
  4. Availability

(c)

Establish a range of security controls to protect assets residing on systems and networks. Consider the use of access controls at your network and the use of data encryption technologies (VPN too) as required. Use removable storage media for critical data so that it can be physically secured.

Reading Material
Authentication, Authorization & Accounting (AAA) • Lesson 3 of 7
In Progress

Unit 2: Understanding Authentication, Authorization, and Accounting


  • In security, AAA (Authentication, Authorization, and Accounting) is a model for access control.
  • Authentication is the process of identifying an individual. 
  • After a user is authenticated, users can access network resources based on the user’s authorization. Authorization is the process of giving individuals access to system objects based on their identity. 
  • Accounting, also known as Auditing, is the process of keeping track of a user’s activity while accessing the network resources, including the amount of time spent on the network, the services accessed while there, and the amount of data transferred during the session.
  • Nonrepudiation prevents one party from denying the actions they carried out. 
  • A user can authenticate using what they know, what they own or possess, and who they are. 
  • When two or more authentication methods are used to authenticate someone, a multifactor authentication system is being implemented.
  • The most common method of authentication with computers and networks is the password. 
  • A password is a secret series of characters that enables a user to access a file, computer, or program. 
  • To hack a password, users will try obvious passwords, brute force attacks, and dictionary attacks. 
  • To make a password more secure, be sure to choose a password that nobody can guess. Therefore, it should be lengthy and should be considered a strong or complex password.
  • A personal identification number (PIN) is a secret numeric password shared between a user and a system that can be used to authenticate the user to the system. 
  • The digital certificate is an electronic document that contains an identity such as a user or organization and a corresponding public key. 
  • A smart card is a pocket-sized card with embedded integrated circuits consisting of nonvolatile memory storage components and perhaps dedicated security logic. 
  • A smart card can contain digital certificates to prove the identity of someone carrying the card and may also contain permissions and access information. 
  • Biometrics is an authentication method that identifies and recognizes people based on voice recognition or physical traits such as a fingerprint, face recognition, iris recognition, and retina scan. 
  • Because administrators have full access to a computer or the network, it is recommended that a standard non-administrator user should perform most tasks.
  • Active Directory is a technology created by Microsoft that provides a variety of network services, including LDAP, Kerberos-based and single sign-on authentication, DNS-based naming and other network information, and central location for network administration and delegation of authority.
  • Kerberos is the default computer network authentication protocol, which allows hosts to prove their identity over a non-secure network in a secure manner.
  • Single sign-on (SSO) allows a user to log on once and access multiple, related, but independent software systems without having to log on again.
  • A user account enables a user to log on to a computer and domain. 
  • The local user account is stored in the Security Account Manager (SAM) database on the local computer.
  • A group is much like it sounds; it is used to group users and computers together so that when rights and permissions are assigned, they are assigned to the group rather than to each user individually. 
  • A right authorizes a user to perform certain actions on a computer, such as logging on to a system interactively or backing up files and directories on a system. 
  • Permission defines the type of access that is granted to an object (an object can be identified with a security identifier) or object attribute. 
  • Explicit permissions are permissions granted directly to the file or folder. 
  • Inherited permissions are permissions that are granted to a folder (parent object or container) that flow into child objects (subfolders or files inside the parent folder). 
  • The owner of the object controls how permissions are set on the object and to whom permissions are granted. 
  • Encryption is the process of converting data into a format that cannot be read by another user. Once a user has encrypted a file, it automatically remains encrypted when the file is stored on a disk. 
  • Decryption is the process of converting data from encrypted format back to its original format. 
  • Encryption algorithms can be divided into three classes: Symmetric, Asymmetric, and Hash function. 
  • Symmetric encryption uses a single key to encrypt and decrypt data. Therefore, it is also referred to as secret-key, single-key, shared-key, and private-key encryption. 
  • Asymmetric encryption, also known as public-key cryptography, uses two mathematically related keys. One key is used to encrypt the data, while the second key is used to decrypt the data.
  • Different from the symmetric and asymmetric algorithms, a hash function is meant as one-way encryption. This means that after it has been encrypted, it cannot be decrypted. 
  • A Public key infrastructure (PKI) is a system consisting of hardware, software, policies, and procedures that create, manage, distribute, use, store, and revoke digital certificates. 
  • The most common digital certificate is the X.509 version 3. 
  • The certificate chain, also known as the certification path, is a list of certificates used to authenticate an entity. It begins with the certificate of the entity and ends with the root CA certificate. 
  • A digital signature is a mathematical scheme that is used to demonstrate the authenticity of a digital message or document. It is also used to confirm that the message or document has not been modified. 
  • When surfing the internet and needing to transmit private data over the internet, use SSL over HTTPS (https) to encrypt the data sent over the internet. By convention, URLs that require an SSL connection start with https: instead of http:. 
  • IP Security, more commonly known as IPsec, is a suite of protocols that provide a mechanism for data integrity, authentication, and privacy for the Internet Protocol. 
  • A virtual private network (VPN) links two computers through a wide-area network, such as the internet. 
  • Windows Hello is a Windows 10 biometric authentication system that uses a user’s face, iris, or fingerprint to unlock devices.
  • Syslog is a standard for logging program messages that can be accessed by devices that would not otherwise have a method for communications.

Select the correct answer(s) for each of the following questions.

1. Which of the following is not a method for authentication? 

  1. Something the user knows 
  2. Something the user owns or possesses 
  3. Encryption 
  4. Something a user is 

(c)

2. Which of the following would not be a biometric device? 

  1. Password reader 
  2. Retina scanner 
  3. Fingerprint scanner 
  4. Face scanning 

(a)

A biometric device is a security identification and authentication device. Such devices use automated methods of verifying or recognizing the identity of a living person based on a physiological or behavioral characteristic. These characteristics include fingerprints, facial images, iris, and voice recognition.

3. Which service is used for centralized authentication, authorization, and accounting? 

  1. VPN 
  2. PGP
  3. RADIUS 
  4. PKI 

(c)

In the realm of IT security, the AAA (Authentication, Authorization, and Accounting) acronym is a model for access control. Authentication is the process of identifying an individual, usually based on a user name and password. After a user is authenticated, the user can access network resources based on the user’s authorization. Authorization is the process of giving individuals access to system objects based on their identity. Accounting, also known as auditing, is the process of keeping track of a user’s activity while accessing the network resources, including the amount of time spent in the network, the services accessed while there, and the amount of data transferred during the session.

RADIUS is a mechanism that allows authentication of dial-in and other network connections including modem dial-up, wireless access points, VPNs, and web servers. As an Internet Engineering Task Force (IETF) standard, RADIUS has been implemented by most of the major operating system manufacturers, including Microsoft Windows.

4. Which of the following is the primary authentication used on Microsoft Active Directory? 

  1. LDAP 
  2. Kerberos 
  3. NTLAN 
  4. SSO 

(b)

Active Directory uses Kerberos version 5 as authentication protocol in order to provide authentication between server and client. Kerberos v5 became the default authentication protocol for Windows servers from windows server 2003.

5. Which of the following are the master timekeeper and master for password changes in an Active Directory domain? 

  1. PDC Emulator 
  2. RID 
  3. Infrastructure master
  4. Schema master 

(a)

PDC Emulator: The DC with the Primary Domain Controller Emulator role is the authoritative DC in the domain. The PDC Emulator responds to authentication requests, changes passwords, and manages Group Policy Objects.

6. Local user accounts are found in which of the following? 

  1. Active Directory 
  2. Registry 
  3. SAM 
  4. LDAP 

(c)

A user account allows a user to log on and gain access to the computer where the account was created. The local user account is stored in the Security Account Manager (SAM) database on the local computer. The only Windows computer that does not have a SAM database is the domain controller. The administrator local user account is the only account that is created and enabled by default in Windows. While the administrator's local user account cannot be deleted, it can be renamed.

7. Which of the following authorizes a user to perform certain actions on a computer? 

  1. Permissions 
  2. An encryption algorithm 
  3. Authentication protocol 
  4. A right 

(d)

A right authorizes a user to perform certain actions on a computer, such as logging on to a system interactively or backing up a system's files and directories. User rights are assigned through local policies or Active Directory group policies.

8. Which file system offers the best security? 

  1. FAT 
  2. FAT32 
  3. NTFS 
  4. EFS

(c)

FAT16 sometimes referred to generically as File Allocation Table (FAT), is a simple file system that uses minimum memory and has been used with DOS. Originally, it supported the 8.3 naming scheme which allowed up to 8-character file names and 3-character filename extensions. Later, it was revised to support long file names. Unfortunately, FAT can only support volumes up to 2 GB.

FAT32 was introduced with the second major release of Windows 95. While the file system can support larger drives, today’s Windows versions typically support volumes up to 32 GB. FAT32 also supports long file names.

NTFS is the preferred file system because it supports large volumes up to 16 exabytes (EB) and long file names. In addition, it is more fault-tolerant than previous file systems used in Windows, because it is a journaling file system. A journaling file system ensures that a disk transaction is written to disk properly before being recognized. Lastly, NTFS offers better security through permissions and encryption.

9. Which NTFS permission is needed to change attributes and permissions? 

  1. Full Control 
  2. Modify
  3. Read & Execute 
  4. Write 

(a)

NTFS permissions allow you to control which users and groups can gain access to files and folders on an NTFS volume. The advantage of NTFS permissions is that they affect local users as well as network users.

10. Which permission is granted directly to the file or folder?

  1. Explicit 
  2. Inherited 
  3. Effective 
  4. Share 

(a)

There are basically six types of permissions in Windows: Full Control, Modify, Read & Execute, List Folder Contents, Read, and Write. List Folder Contents is the only permission that is exclusive to folders. There are more advanced attributes, but you'll never need to worry about those.

11. When copying a file or folder to a new volume, which permissions are acquired? 

  1. The same permissions that it had before. 
  2. The same permissions as the target folder. 
  3. The same permissions as the source folder. 
  4. No permissions 

(b)

When you copy or move an object to another volume, the object inherits the permissions of its new folder.

12. Which of the following uses an ACL? (Choose all that apply.) 

  1. NTFS folder 
  2. Active Directory user
  3. Registry key 
  4. Logon rights 

(a), (b), (c)

Permission defines the type of access that is granted to an object (an object can be identified with a security identifier) or object attribute. The most common objects assigned permissions are NTFS files and folders, printers, and Active Directory objects. To keep track of which user can access an object and what the user can do with that object, refer to the access control list (ACL). The ACL lists all users and groups that have access to the object.

13. Which type of key has one key for encryption and a different key for decryption? 

  1. Symmetric 
  2. Asymmetric 
  3. Hash function 
  4. PKI 

(b)

Asymmetric encryption uses two keys for encryption. The asymmetric key, also known as public-key cryptography, uses two mathematically related keys. One key is used to encrypt the data, while the second key is used to decrypt the data. Unlike symmetric key algorithms, it does not require a secure initial exchange of one or more secret keys to both sender and receiver. Instead, you can make the public key known to anyone and use the other key to encrypt or decrypt the data. The public key could be sent to someone or could be published within a digital certificate via a Certificate Authority (CA). Secure Sockets Layer (SSL)/Transport Layer Security (TLS) and Pretty Good Privacy (PGP) use asymmetric keys. Two popular asymmetric encryption protocols are Diffie-Hellman and RSA.

For example, say you want a partner to send you data. Therefore, you send the partner the public key. The partner will then encrypt the data with the key and send you the encrypted message. Then, you use the private key to decrypt the message. If the public key falls into someone else’s hands, they still could not decrypt the message.

14. Which infrastructure is used to assign and validate digital certificates? 

  1. Asymmetric algorithm 
  2. Active Directory 
  3. PKI 
  4. VPN 

(c)

A public key infrastructure (PKI) is a system consisting of hardware, software, policies, and procedures that create, manage, distribute, use, store, and revoke digital certificates. Within the PKI, the certificate authority (CA) binds a public key with respective user identities and issues digital certificates containing the public key. For this system to work, the CA must be trusted. Typically, within an organization, you may install a CA on a Windows server, specifically on a domain controller, and it would be trusted within the organization. If it is necessary to have a CA trusted outside of your organization, use a trusted third-party CA, such as VeriSign or Entrust. Established commercial CAs charge to issue certificates that will automatically be trusted by most web browsers.

15. Which technology is used to encrypt an individual file on an NTFS volume? 

  1. BitLocker 
  2. BitLocker To Go 
  3. PPTP 
  4. EFS 

(d)

The Encrypting File System (EFS) on Microsoft Windows is a feature introduced in version 3.0 of NTFS that provides filesystem-level encryption. The technology enables files to be transparently encrypted to protect confidential data from attackers with physical access to the computer.

16. Which physical device is used to authenticate users based on what a user has? 

  1. Smart card 
  2. Windows Hello 
  3. Universal Windows Platform 
  4. Device Guard 

(a)

Biometrics authentication devices rely on physical characteristics such as fingerprint, facial patterns, or iris or retinal patterns to verify user identity. Biometrics authentication is becoming popular for many purposes, including network logon.

17. Which of the following is two-factor authentication that uses an enrolled device and Windows Hello? 

  1. Device Guard
  2. Credential Guard 
  3. Virtual secure mode
  4. Microsoft Passport

(d)

Microsoft Passport is two-factor authentication that consists of an enrolled device (such as a smartphone) and a Windows Hello (biometric) or PIN. The two factors are an encrypted key stored on the device combined with Windows Hello or a PIN. Microsoft Passport lets users authenticate to a Microsoft account, an Active Directory account, a Microsoft Azure Active Directory (AD) account, or a non-Microsoft service that supports Fast ID Online (FIDO) authentication.

18. A(n) ______  is a secret numeric password shared between a user and a system that can be used to authenticate the user to the system. (answer choices)

  1. PIN
  2. retinal scanner
  3. id badge
  4. voice recognition

(a)

A personal identification number (PIN) is a secret numeric password shared between a user and a system that can be used to authenticate the user to the system.

19. A pocket-sized card with embedded integrated circuits used for authentication is known as a(n)? (answer choices)

  1. smart card
  2. security token
  3. encryption key
  4. PKI

(a)

A smart card is a pocket-sized card with embedded integrated circuits consisting of non-volatile memory storage components, and perhaps, dedicated security logic. Non-volatile memory is a memory that does not forget its contents when power is discontinued. Smart cards can contain digital certificates to prove the identity of someone carrying the card and may also contain permissions and access information. Because a smart card can be stolen, some smart cards will not have any markings on them, so they cannot be easily identified as to what they can open. In addition, many organizations will use a password or PIN in combination with the smart card.

20. A device that may provide a second password to log on to a system is a(n) (answer choices)

  1. smart card
  2. security token
  3. encryption key
  4. PKI

(b)

A security token (or sometimes a hardware token, hard token, authentication token, USB token, cryptographic token, or key fob) is a physical device that an authorized user of computer services is given to ease authentication. Hardware tokens are typically small enough to be carried in a pocket and are often designed to attach to a user’s keychain. Some of these security tokens include a USB connector, RFID functions, or Bluetooth wireless interface to enable the transfer of a generated key number sequence to a client system. Some security tokens may also include additional technology such as a static password or digital certificate built into the security token, much like a smart card. Other security tokens may automatically generate a second code that will have to be entered to get authenticated.

21. The _____  holds a copy of the centralized database used in Active Directory. (answer choices)

  1. domain controller
  2. permissions folder
  3. authentication protocol
  4. SAM

(a)

In Active Directory, each user is assigned a SAM account name; therefore, each user name must be unique. Domain Controller A domain controller is a server that holds a copy of the Active Directory database that can be written to.

22. A(n) ______ defines the type of access over an object or the properties of an object such as an NTFS file or printer. (answer choices)

  1. registry
  2. ownership
  3. permission
  4. surface attack

(c)

Permissions define the type of access that is granted to a user or group for an object or object property. By using the access control user interface, you can set NTFS permissions for objects such as files, Active Directory objects, registry objects, or system objects such as processes.

23. The ______ permissions flow from the parent object to the child object. (answer choices)

  1. explicit
  2. encrypted
  3. inherited
  4. full

(c)

Explicit permissions are permissions granted directly to a file or folder while inherited permissions are permissions that are granted to a parent object and they flow down.


24. When a folder cannot be accessed because someone removed the permissions so that no one can access it, it is necessary to take ________ of the folder. (answer choices)

  1. registry
  2. ownership
  3. permission
  4. surface attack

(b)

The owner of a file or folder is the user who has complete and full control over that file or folder in terms of being able to grant access to the resource and also allow other users to take over the ownership of a file or folder.

25. The centralized database that holds most of the Windows configurations is known as the (answer choices)

  1. audit
  2. authorization
  3. registry
  4. domain controller

(c)

The Registry contains information that Windows continually references during operation, such as profiles for each user, the applications installed on the computer and the types of documents that each can create, property sheet settings for folders and application icons, what hardware exists on the system, and the ports.

26. To track a user’s activities in Windows, it is necessary to enable what? (answer choices)

  1. authorization
  2. encryption
  3. auditing
  4. permissions

(c)

Windows auditing is a mechanism for tracking events. Knowing when and where these events occurred and who triggered them can help when doing Windows network forensics. It can also be very helpful with detecting certain types of problems like improper rights assignments in the file system.





Reading Material
Security Policies, GPOs & User Rights • Lesson 4 of 7
In Progress

Unit 3: Understanding Security Policies & Group Policy Objects (GPOs)

Remember Points

  • The strength of a password can be determined by examining the length, complexity, and randomness of the password. 
  • A complex password will use characters from at least three of the following categories: uppercase characters, lowercase characters, numeric characters, and non-alphanumeric characters. 
  • Account lockout refers to the number of incorrect login attempts permitted before the system will lock the account. 
  • The length of a password is a key component of ensuring the strength of a password.  
  • The minimum password age setting controls how many days a user must wait before they can reset their password. 
  • The maximum password age setting controls the maximum period of time permitted before a user is forced to reset their password. 
  • A Group Policy Object (GPO) is a set of rules which allow an administrator granular control over the configuration of objects in Active Directory (AD), including user accounts, operating systems, applications, and other AD objects. 
  • Passwords have long been recognized as one of the weak links in many security programs. 
  • A dictionary attack (also known as a brute force attack) uses a dictionary containing an extensive list of potential passwords that the attacker then tries in conjunction with a user ID to attempt to guess the correct password. 
  • A brute force attack tries all the combinations of the permitted character types. 
  • Physical attacks on a computer can completely bypass almost all security mechanisms, by capturing the passwords and other critical data directly from the keyboard when a software or hardware keylogger is used. 
  • In a cracked password attack, the attacker gets access to an encrypted password file from a workstation or server. Once they have access, the attacker will start running password cracking tools against the file. 
  • If an attacker can gain access to your internal network, your wireless network, or even an internet access point used by your employees, they have the ability to use a specialized tool known as a sniffer to try to intercept unencrypted passwords. 
  • While not as prevalent an issue as it was in times past, there is still the possibility that someone could sit down at your computer and guess your password. 
  • Device Guard helps harden a computer system against malware by running only trusted applications, thereby preventing malicious code from running. 
  • Credential Guard isolates and hardens key system and user security information. The Credential Guard and Device Guard technologies are available only through Windows 10 Enterprise.

Select the correct answer(s) for each of the following questions. 

1. Which of the following are not valid password controls? (Choose all that apply.) 

  1. Minimum Password Age 
  2. Maximum Password Age 
  3. Maximum Password Length 
  4. Account Lockout Threshold 
  5. Password History 

(c), (d)

2. Which of the following would be an acceptable password on a Windows 10 Pro system with Password Complexity enabled and a minimum password length set to 8? (Choose all that apply.) 

  1. Summer2010 
  2. $$Thx17 
  3. ^^RGood4U 
  4. Password 
  5. St@rTr3k 

(a), (c), (e)

  • Password must not contain the user's account name or more than two consecutive characters from the user's full name.
  • Password must be six or more characters long.
  • Password must contain characters from three of the following four categories:
    • Uppercase characters A-Z (Latin alphabet)
    • Lowercase characters a-z (Latin alphabet)
    • Digits 0-9
    • Special characters (!, $, #, %, etc.)

3. Which of the following is the maximum setting for Minimum Password Age? 

  1. 14 
  2. 999 
  3. 998 
  4. 256 

(c)

The Minimum password age policy setting determines the period of time (in days) that a password must be used before the user can change it. You can set a value between 1 and 998 days, or you can allow password changes immediately by setting the number of days to 0.

4. Which of the following corresponds with the minimum and maximum password history settings for securing a Windows 10 Pro workstation image? (Choose the best answer.) 

  1. 0, 14 
  2. 1, 14 
  3. 0, 24 
  4. 1, 24 
  5. 0, 998 

(c)

Microsoft allows a password history setting between 0 and 24. A fairly common setting in standard environments is 10, although Windows Server 2008 and higher defaults to 24 for domain controllers and domain member computers.

5. Which of the following are common password attacks? (Choose all that apply.) 

  1. Cracking 
  2. Phreaking 
  3. Phishing 
  4. Leaking 
  5. Brute force 

(a), (e)

6. Which of the following refers to a form of brute force password attack that uses an extensive list of pre-defined passwords? (Choose the best answer.) 

  1. Bible 
  2. Cracking 
  3. Guessing 
  4. Dictionary 

(d)

Hackers will try to crack passwords by first trying obvious passwords, including the name of spouse/partner or children, birthdays, keywords used by the user, hobbies of the user, and common passwords. Then hackers will try brute force attacks, which consist of trying as many combinations of characters as time and money permit. A subset of the brute force attack is the dictionary attack, in which all words in one or more dictionaries are tested. Lists of common passwords are also typically tested.

7. Which setting should be applied to ensure that a possible dictionary attack against a Windows application server has a limited chance of success? (Choose the best answer.) 

  1. Minimum Password Length 
  2. Account Lockout Threshold 
  3. Password History 
  4. Maximum Password Age

(b)

Account lockout refers to the number of incorrect login attempts permitted before the system will lock the account. Each bad logon attempt increments the bad logon counter, and when the counter exceeds the account lockout threshold, no further login attempts will be permitted.

8. Which Administrative Tool should be used to configure password control settings on a new standalone server? 

  1. Active Directory Users and Computers 
  2. Computer Management 
  3. Security Service 
  4. Local Security Policy 

(d)

9. Which two features in Windows Server 2008 and higher permit the use of fine-grained password policies? (Choose two.) 

  1. Global Policy Object 
  2. Password Settings Container 
  3. Password Settings Object 
  4. Password Policy 

(b), (c)

Fine-grained password policies allow you to specify multiple password policies within a single domain so that different restrictions for password and account lockout policies can be applied to different sets of users in a domain. To use a fine-grained password policy, the domain functional level must be at least Windows Server 2008. To enable fine-grained password policies, first, create a Password Settings Object (PSO). Then, configure the same settings that are configured for the password and account lockout policies. In the Windows Server 2016 environment, PSOs can be created and applied by using the Active Directory Administrative Center (ADAC) or Windows PowerShell.

10. Which of the following explains why a minimum password age would be set? 

  1. To ensure that no one can guess a password 
  2. To stop someone from trying over and over to guess a password 
  3. To make sure a user cannot reset a password multiple times until he or she can reuse his or her original password 
  4. To automatically reset a password 

(c)

The Minimum password age policy setting determines the period of time (in days) that a password must be used before the user can change it.

11. Which of the following uses the processor’s virtualization to protect the PC, including data and credential tokens on the system’s disks? 

  1. Virtual smart cards 
  2. Device Guard 
  3. Credential Guard 
  4. Windows Hello 

(a)

Device Guard and Credential Guard use Windows 10 virtual secure mode (VSM) which, in turn, uses the processor’s virtualization to protect the PC, including data and credential tokens on the system’s disks. By using hardware virtualization, Windows 10 is organized into multiple containers. Windows runs one container; the Active Directory security tokens that allow access to your organization’s resources run in another container. Each container is isolated from the other. Therefore, if Windows is compromised by malware, the tokens are protected because they are isolated in their own encrypted container.

12. In Windows 10, which component is used by Device Guard and Credential Guard to protect the PC? 

  1. Windows Store 
  2. Virtual smart cards 
  3. Windows Hello 
  4. Virtual secure mode

(d)

Device Guard helps harden a computer system against malware by running only trusted applications, thereby preventing malicious code from running. Credential Guard isolates and hardens key system and user security information. Both technologies are available only through Windows 10 Enterprise.

Reading Material
Network Security, Firewalls & Isolation • Lesson 5 of 7
In Progress

Unit 4: Understanding Network Security & Boundary Defense

  • A firewall is a system that is designed to protect a computer or a computer network from network-based attacks. A firewall does this by filtering the data packets traversing the network.
  • Firewalls based on packet filtering inspect the data packets as they attempt to traverse the firewall, and based on rudimentary rules, such as permitting all outbound traffic while denying all inbound traffic, or blocking specific protocols from passing through the router, like telnet or FTP. 
  • Instead of analyzing each individual packet, a circuit-level firewall monitors TCP/IP sessions by monitoring the TCP handshaking between packets to validate the session. 
  • Application-level firewalls (also known as proxy servers) work by performing a deep inspection of application data as it traverses the firewall. Rules are set based on analyzing client requests and application responses, then enforcing correct application behavior. 
  • Stateful multi-level firewalls are designed to provide the best features of both packet-filtering and application-level firewalls. 
  • Virtual LANs (VLANs) were developed as an alternate solution to deploying multiple routers. VLANs are logical network segments used to create separate broadcast domains, but still allow the devices on the VLANs to communicate at Layer 2, without requiring a router. 
  • Intrusion detection systems (IDS) are designed to detect unauthorized user activities, attacks, and network compromises. 
  • An intrusion prevention system (IPS) is very similar to an IDS, except that, in addition to detecting and alerting, an IPS can also take action to prevent a breach from occurring.
  • Honeypots, honeynets, and padded cells are complementary technologies to IDS/IPS deployments. A honeypot is a trap for hackers.
  • A DMZ is a firewall configuration used to secure hosts on a network segment. In most DMZs, the hosts on the DMZ are connected behind a firewall which is also connected to a public network like the internet.
  • Network Address Translation (NAT) is a technique used to modify the network address information of a host while traffic is traversing a router or firewall. This technique is used to hide the network information of a private network while allowing traffic to be transferred across a public network like the internet.
  • DNS Security Extensions (DNSSEC) adds security provisions to DNS so that computers can verify that they have been directed to proper servers.
  • Protocol spoofing is the misuse of a network protocol to perpetrate a hoax on a host or a network device. 
  • The denial-of-service (DoS) attack floods the network being attacked with overwhelming amounts of traffic, shutting down the network infrastructure like a router or firewall. 
  • A man-in-the-middle attack is a type of attack where the attacker breaks into the communication between the endpoints of a network connection. Once the attacker has broken into the communication stream, he can intercept data being transferred, or even inject false information into the data stream. 
  • Backdoor attacks are attacks against an opening left in a functional piece of software that allows access to a system or software application without the owner’s knowledge. 
  • A DNS poisoning attack is an attack against the cached information on a DNS server.
  • A replay attack occurs when an attacker is able to capture an intact data stream from the network using a network sniffer, modify certain components of the data stream, and then replay the traffic back to the network to complete their attack. 
  • A buffer overflow attack exploits poorly written code by injecting data into variable fields and leveraging the response to access information in the application. 
  • SQL injection attacks are one of the oldest attacks against web applications using the SQL Server database application. 
  • A wireless LAN (WLAN) allows users to connect to a network while allowing them to remain mobile. 
  • The SSID (Service Set Identifier) is the name for the WLAN. A connecting host must know the SSID to connect. 
  • WEP (Wired Equivalent Privacy) is an older wireless encryption protocol, which rapidly fell out of favor when a flaw with the encryption mechanism was found.
  • WPA (Wi-Fi Protected Access) was designed as the interim successor to WEP. 
  • WPA2 (Wi-Fi Protected Access version 2) is the standards-based version of WPA, except WPA2 implements all the IEEE 802.11i standards. 
  • A MAC address is the unique hardware address of a network adapter. 
  • By turning MAC filtering on, network access can be limited to only permitted systems by entering the MAC address information into the MAC filters. 

Multiple Choice 

Select the correct answer(s) for each of the following questions. 

1. Which of the following should be considered when deciding whether to use a software or hardware firewall? (Choose all that apply.) 
  1. Host operating system 
  2. Application conflicts 
  3. Operating system version 
  4. Firewall service efficiency 
  5. Stability 

(a), (b), (e)

A firewall is a security device — computer hardware or software — that can help protect your network by filtering traffic and blocking outsiders from gaining unauthorized access to the private data on your computer.

2. Which of the following are layers of the OSI model? (Choose all that apply.) 
  1. Physical 
  2. Control 
  3. Application 
  4. Network 
  5. Encryption 

(a), (c), (d)

  • Physical Layer
  • Data Link Layer
  • Network Layer
  • Transport Layer
  • Session Layer
  • Presentation Layer
  • Application Layer
3. Routing occurs at which layer of the OSI model? 
  1. Physical 
  2. Data-link 
  3. Transport 
  4. Session 
  5. Network

(e)

Layer 3, the network layer, is most commonly known as the layer where routing takes place.

4. Which of the following are valid firewall types? (Choose all that apply.) 
  1. Virtual 
  2. Network 
  3. Packet filtering 
  4. IPsec 
  5. Application 

(c), (e)

Four Types of Firewalls

  • Packet filtering firewalls. Packet filtering firewalls are the oldest, most basic type of firewalls.
  • Circuit-level gateways.
  • Stateful inspection firewalls.
  • Application-level gateways (proxy firewalls)
5. Which of the following are typically examined by a stateful inspection firewall? (Choose all that apply.) 
  1. IP address of the sending host 
  2. IP address of the receiving host 
  3. IP address of the router d. Data packet type 
  4. Data packet size 

(a), (b), (d)

A stateful firewall examines packet headers and, essentially, remembers something about them (generally source/destination IP address/ports). The firewall then uses this information when processing later packets.

6. Which of the following is an attack that relies on having a user execute a malicious script embedded in a web page? (Choose the best answer.) 
  1. Man-in-the-middle 
  2. Brute force 
  3. Cross-site scripting 
  4. SQL injection 

(c)

Cross-site scripting (also known as XSS) is a web security vulnerability that allows an attacker to compromise the interactions that users have with a vulnerable application.

7. A small business owner has purchased a new wireless access point and wants to ensure that only his systems are able to connect to the wireless. He enables MAC address filtering and puts the MAC addresses for all of his computers in the permitted table. This filtering occurs at which layer of the OSI model? 
  1. Physical layer 
  2. Data-link layer 
  3. Network layer 
  4. Transport layer 
  5. Session layer 

(b)

8. A sales team for a medium-sized manufacturing company has just deployed a new e-commerce application to allow for the direct sale of products to its customers. To secure that solution, an application firewall is deployed. At which layer of the OSI model does the application firewall occur? 
  1. Physical layer 
  2. Data-link layer 
  3. Network layer 
  4. Presentation layer 
  5. Application layer 

(b)

Layer 2 of The OSI Model: Data Link Layer provides the functional and procedural means to transfer data between network entities and to detect and possibly correct errors that may occur in the physical layer.

9. Which of the following are password-based attacks? (Choose all that apply.) 
  1. Replay 
  2. Network sniffer 
  3. Brute force 
  4. Man-in-the-middle 
  5. Dictionary 

(c), (e)

10. Which of the following is an attack that relies on the attacker being able to trick the sending host into thinking his system is the receiving host, and the receiving host into thinking his system is the sending host? (Choose the best answer.) 
  1. Replay 
  2. Brute force 
  3. Man-in-the-middle 
  4. Cross-site scripting 
  5. SQL Injection

(c)

A form of active wiretapping attack in which the attacker intercepts and selectively modifies communicated data to masquerade as one or more of the entities involved in a communication association.

11. Which of the following are common uses for a VPN? (Choose all that apply.) 
  1. Remote access 
  2. Server isolation 
  3. Intrusion detection 
  4. Extranet connections 
  5. Domain isolation 

(a), (d)

12. Which of the following are common types of routing protocols? (Choose all that apply.) 
  1. Link vector 
  2. Dynamic link 
  3. Distance link 
  4. Distance vector 
  5. Link state 

(d), (e)

A routing protocol specifies how routers communicate with each other to distribute information that enables them to select routes between nodes on a computer network.

13. Which type of DoS attack uses large ICMP packets to cause an overflow of the memory buffers allocated for packets? 
  1. SYN flood 
  2. ICMP flood 
  3. Ping of death 
  4. HTTP flood

(c)

A ping of death attack sends multiple malformed or malicious pings to a computer.

Reading Material
Protecting Server, Client & Operating Systems • Lesson 6 of 7
In Progress

Unit 5: Protecting the Server and Client


  • Because a client computer is connected to an organization’s network, which may have direct and indirect access to servers and network resources, it is important to protect the client computer. 
  • A computer virus is a program that can copy itself and infect a computer without the user’s consent or knowledge. 
  • A backdoor is a program that gives some remote, unauthorized control of a system or initiates an unauthorized task. 
  • Some viruses, worms, rootkits, spyware, and adware are made possible because they exploit some security holes within Windows, Internet Explorer, or Microsoft Office. 
  • The first step that should be taken to protect yourself against malware is to keep your system up-to-date with the latest service packs, security patches, and other critical fixes for Windows (as well as other Microsoft products, such as Internet Explorer and Microsoft Office). 
  • A virus hoax is a message warning the recipient of a non-existent computer virus threat, usually sent as a chain email that tells the recipient to forward it to everyone they know. It is a form of social engineering that plays on people’s ignorance and fear and may include emotive language and encouragement to forward the message to other people. 
  • User Account Control (UAC) is a feature that was introduced in Windows Vista and is included with Windows 10 that helps guard against malware. 
  • Microsoft recommends always using the Windows Firewall. 
  • Offline files are copies of network files that are stored on your computer so that they can be accessed when not connected to the network or when the network folder with the files is not connected. 
  • Offline files are not encrypted unless you choose to encrypt them. Consider encrypting your offline files if they contain sensitive or confidential information, and you want to make them more secure by restricting access to them. 
  • By restricting users to standard user accounts, you can limit what software those users can install. 
  • Use group policies to restrict what software can be executed on a client's computer. 
  • Most of the emails will be unsolicited emails called spam or junk email. 
  • The best place to establish an anti-spam filtering system is on your email relay, on a dedicated server or appliance, or as part of a firewall device or service. 
  • Many anti-spam solutions will also use Real-time Blackhole Lists (RBLs) or a DNS-based Blackhole List (DNSBL), which can be accessed freely. RBLs and DNSBL are lists of known spammers that are updated frequently. 
  • Sometimes, spammers will try to spoof a legitimate email address or IP address when the message actually comes from one with an email address or IP address that would likely be identified as spam. 
  • Simple Mail Transfer Protocol (SMTP) is used to transfer email from one server to another and it is also responsible for outgoing mail transport. 
  • Spammers look for unprotected SMTP servers through which they can relay their email. 
  • A cookie is a piece of text stored by a user’s web browser. It can be used for a wide range of items, including user identification, authentication, storing site preferences, and shopping cart contents. 
  • While some pop-up windows are useful website controls, most are simply annoying advertisements, with some attempting to load spyware or other malicious programs. 
  • To help manage Internet Explorer security when visiting sites, Internet Explorer divides a network connection into four content zones or types. For each of these zones, a security level is assigned. 
  • Phishing and pharming are forms of attacks to get users to a bogus website in an attempt to spread malware or collect personal information. 
  • When surfing the internet, there are times when it is necessary to transmit private data such as credit card numbers, Social Security numbers, and so on. During these times, it is important to use http over SSL (https) to encrypt the data sent over the internet. 
  • The server should be kept in a secure location. In addition, the servers should be in their own subnet to reduce the amount of traffic to the servers, especially broadcasts.
  • To secure a server is to harden the server by reducing its surface of attack and thereby reducing the server’s vulnerabilities. To harden a server, look for security guides and best practices for Windows servers and for the specific network services that you are installing. 
  • Windows servers provide support for the dynamic update functionality. Dynamic DNS lets client computers dynamically update their resource records in DNS. 
  • To keep your DNS server secure, secure DNS makes it so that only members of an Active Directory domain can create records on the DNS server.

Multiple Choice 

Select the correct answer(s) for each of the following questions. 
1. Which type of malware copies itself onto other computers without the owner’s consent and will often delete or corrupt files? 
  1. Virus 
  2. Worm 
  3. Trojan horse 
  4. Spyware 

(a)

A computer virus is a program that can copy itself and infect a computer without the user’s consent or knowledge. Early viruses were usually some form of executable code that was hidden in the boot sector of a disk or as an executable file (a file name with an .exe or .com extension).

2. Which type of malware collects personal information or browsing history, often without the user’s knowledge? 
  1. Virus 
  2. Worm 
  3. Trojan horse 
  4. Spyware 

(d)

Spyware is a type of malware that is installed on computers and collects personal information and browsing habits, often without the user’s knowledge. Spyware can also install additional software, which can redirect your web browser to other sites or change your home page.

One type of spyware is the keylogger, which records every key a user presses. Therefore, when typing credit card numbers, Social Security numbers, and passwords, that information gets recorded and is eventually sent to and read by someone without the user’s knowledge. It should be noted that not all keyloggers are bad, because some corporations use them to monitor their corporate users.

Adware is any software package that automatically plays, displays, or downloads advertisements to a computer after the software is installed on it or while the application is being used. While adware may not necessarily be bad, it is often used with ill intent.

3. Which of the following is most likely the problem when a computer seems to be slow and a different default web page displays? 
  1. The ISP has slowed the network connection. 
  2. The computer has been infected with malware. 
  3. The computer has not been updated. 
  4. The user accidentally clicked the turbo button. 

(b)

Malicious software, sometimes called malware, is software designed to infiltrate and adversely affect a computer system without the owner’s informed consent. It is usually associated with viruses, worms, Trojan horses, spyware, rootkits, and dishonest adware. As a network administrator or computer technician, it is important to know how to identify malware, how to remove malware, and how to protect a computer from malware

4. Which of the following is the best thing to do to protect a computer against malware, besides installing an antivirus software package? (Choose the best answer.)
  1. Keep the computer up-to-date with the latest security patches. 
  2. Reboot the computer on a regular basis. 
  3. Change the password on a regular basis. 
  4. Spoof the IP address. 

(a)

To avoid malware, be sure to use common sense by following these suggestions: 
  • Don’t install unknown software or software from an unknown source. 
  • Don’t open strange email attachments. 
  • Don’t click hyperlinks from strangers or if it’s unclear what the link is supposed to do. This also applies to sources like Yahoo!, AOL, and MSN. 
  • If your email client supports auto launch, turn it off. Otherwise, you might automatically activate a computer virus just by opening the email. 
  • Don’t visit questionable websites, especially sites that allow downloading software from music and video piracy sites and pornography sites. 
  • If your web browser alerts you that a site is known for hosting malware, pay attention to these warnings. 
  • If you surf the internet and browser pop-ups indicate that you need to download the newest driver or check your system for viruses, use caution. 
  • Don’t forget to perform regular backups. So, if a computer does get a virus and data is lost, you can restore from a backup.
5. Which of the following refers to a thoroughly tested, cumulative set of hotfixes and other patches? 
  1. Recommended update 
  2. Hotfix pack 
  3. Service pack 
  4. Critical update

(c)

The first step that should be taken to protect yourself against malware is to keep your system up-to-date with the latest service packs, security patches, and other critical fixes for Windows (as well as other Microsoft products, such as Internet Explorer and Microsoft Office).

6. Which technology is used by Windows to prevent unauthorized changes to your system? 
  1. UAC 
  2. Protected mode 
  3. Windows Defender 
  4. ProtectGuard 

(a)

User Account Control (UAC) is a feature that was introduced in Windows Vista and is included with Windows 10 that helps guard against malware.

7. When using UAC, which of the following tasks requires administrative permissions or rights? 
  1. Install updates from Windows Update. 
  2. Change the date and time. 
  3. Reset the network adapter. 
  4. Install drivers from Windows Update. 

(b)

UAC can be enabled or disabled for any individual user account. Of course, if UAC is disabled for a user account, the computer will be at higher risk. However, if you perform a lot of administrative tasks on a computer, the UAC prompts can be annoying and can stop you from doing certain activities, including saving to the root directory of a drive, or using an application that is not compatible with UAC.

8. When attempting to change the display settings, which of the following causes a pop-up that prompts if a user wants to continue? 
  1. Windows Firewall 
  2. Protected Mode 
  3. Windows Update 
  4. UAC 

(d)

UAC can be enabled or disabled for any individual user account. Of course, if UAC is disabled for a user account, the computer will be at higher risk. However, if you perform a lot of administrative tasks on a computer, the UAC prompts can be annoying and can stop you from doing certain activities, including saving to the root directory of a drive, or using an application that is not compatible with UAC.

9. Which host-based firewall software comes with Windows 10? 
  1. Windows Firewall 
  2. Windows Protected Mode 
  3. UAC 
  4. Windows GuardIt 

(a)

Microsoft recommends always using the Windows Firewall.

10. Which program can be used to configure IPsec on a computer running Windows Server 2016? 
  1. Windows Firewall with IPsec Plugin 
  2. IPsec Monitor 
  3. Windows Firewall with Advanced Security 
  4. IPsec Configuration console 

(c)

In addition to the Windows Firewall found in Control Panel, newer versions of Windows include Windows Firewall with Advanced Security. Windows Firewall with Advanced Security combines a host firewall and Internet Protocol security (IPsec). Windows Firewall and Windows Firewall with Advanced Security are tightly coupled together, allowing better control of a firewall. In addition, Windows Firewall with Advanced Security provides computer-to-computer connection security, because it can be used to require authentication and data protection for communications via IPsec.

11. Which of the following tasks is recommended if sensitive or confidential information is stored in offline files? 
  1. Clear the cache. 
  2. Encrypt the offline files. 
  3. Clear the cookies. 
  4. Execute ipconfig /renewip. 

(b)

Offline files are not encrypted unless you choose to encrypt them. Consider encrypting your offline files if they contain sensitive or confidential information, and you want to make them more secure by restricting access to them.

12. Which of the following tasks should be performed if legitimate emails are being blocked at a spam-blocking device? 
  1. Flush out the quarantined items. 
  2. Reboot the spam-blocking device. 
  3. Add the email address or domain to the allow list. 
  4. Add the email address or domain to the block list. 

(c)

13. SMTP uses which of the following TCP ports? 
  1. 43 
  2. 25 
  3. 80 
  4. 443 

(b)

14. When using IE, how many content zones are there? 
  1. 1 
  2. 2 
  3. 4 
  4. 8

(c)

15. Which of the following refers to a social engineering technique in which a user receives an email stating that his account has just expired and he should log on to a legitimate-looking website to fix the problem? 
  1. Phishing 
  2. Pharming 
  3. Phaking 
  4. Spoofing the IP address 

(a)

Phishing and pharming are forms of attacks to get users to access a bogus website so the phisher or pharmer can spread malware and/or collect personal information.

16. Which of the following is used to stop a program from running on a Windows 10 system? 
  1. AppLocker 
  2. Windows Defender 
  3. Microsoft Passport 
  4. Smart card 

(a)

Use AppLocker to control how users access and use programs and files, and extend the functionality originally provided by the Software Restriction policy found in earlier versions of Windows operating systems. In Windows 10, AppLocker is located in the Local Group Policy Editor.

17. Which type of account is used with outlook.com and OneDrive and can be used to synchronize a desktop across multiple computers? 
  1. Domain account 
  2. Microsoft account 
  3. Local account 
  4. Virtual account 

(b)

18. Which of the following is a collection of security settings that can be used to configure client settings? 
  1. Biometrics 
  2. Windows Defender 
  3. Security baseline 
  4. Windows Store 

(c)

A security baseline is a collection of security settings. Security baselines should include Microsoft’s recommendations for configuring those settings. To help with faster deployments, and to ease the managing of Windows, Microsoft provides customers with security baselines that can be used with Group Policy Objects (GPOs).

19. Which of the following is a free tool that allows administrators to quickly configure and manage desktops and users using Group Policy? 
  1. STRIDE 
  2. DREAD 
  3. Trusted Platform Module 
  4. Security Compliance Manager

(c)

Security Fundamentals & Layered Defense Quiz

Security Layers & Principles Quiz

3 questions • Test your knowledge

Question 1
What is the core philosophy behind the "Defense-in-Depth" layered security model?
Question 2
Which security principle ensures that a sender cannot deny having sent a specific message or performed an action?
Question 3
What is the very first physical security layer when protecting an enterprise data center?
Authentication, Authorization & Accounting (AAA) Quiz

AAA & Authentication Protocols Quiz

3 questions • Test your knowledge

Question 1
Which authentication factor does a fingerprint or retina scan represent?
Question 2
Which default authentication protocol is used in Microsoft Active Directory domain environments for single sign-on (SSO)?
Question 3
In the AAA framework, what does "Accounting" refer to?
Security Policies, GPOs & User Rights Quiz

Security Policies & GPOs Quiz

3 questions • Test your knowledge

Question 1
Which Windows Server management tool allows administrators to centrally configure and enforce security settings across domain computers and users?
Question 2
What does an "Account Lockout Threshold" policy setting enforce?
Question 3
What is the security principle that dictates granting users only the minimum permissions necessary to perform their job duties?
Network Security, Firewalls & Isolation Quiz

Network Security & Firewalls Quiz

3 questions • Test your knowledge

Question 1
What is a Demilitarized Zone (DMZ) in network architecture?
Question 2
Which protocol suite provides secure, encrypted communication at the Network Layer (Layer 3) for VPN connections?
Question 3
What is a "Honeypot" in cybersecurity defense?
Protecting Server, Client & Operating Systems Quiz

Server & Client Protection Quiz

3 questions • Test your knowledge

Question 1
Which Windows feature provides full-volume encryption to protect data at rest on laptops and lost storage drives?
Question 2
What is the primary role of WSUS (Windows Server Update Services) in an enterprise network?
Question 3
What is the purpose of User Account Control (UAC) in Windows?
MTA 98-367 Practice Exam & Assessment Quiz

MTA 98-367 Comprehensive Practice Exam

3 questions • Test your knowledge

Question 1
Which type of attack occurs when an attacker intercepts and alters communication between two legitimate parties without their knowledge?
Question 2
Which technology allows isolating virtual broadcast domains on a physical network switch without needing separate physical cabling?
Question 3
Which DNS security extension provides cryptographic authentication and integrity validation for DNS query responses?
High-Resolution Preview